Collabora: WOPI request denied

[UltraBlackLinux]

Steps to reproduce

Open any file in collabora

Expected behavior

The file should open

Actual behavior

it denies the wopi request

Host OS

Arch Linux

Nextcloud AIO version

8.2.1

Current channel

latest

Other valuable info

[richdocuments] Warning: WOPI request denied from <my public ip> as it does not match the configured ranges: 93.213.231.142, 127.0.0.1/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, fd00::/8, ::1, 93.213.227.157, 91.1.116.28
	GET /index.php/apps/richdocuments/wopi/files/989_ocvsob04948q?access_token=7GSy6kh7dUiBRL8HplWZl3IYG0JqwEzC&access_token_ttl=0
	from <my public ip> by -- at Jun 9, 2024, 4:28:53 PM

it starts working when I restart nextcloud, but I cannot do that from within nextcloud, rendering collabora useless.

[szaimen]

Hi, you could add 0.0.0.0 to the wopi allowlist in the richdocuments admin settings

[UltraBlackLinux]

well. That did not work.
I'm also confused why it would work after a restart, with the same config, mind you.

[szaimen]

Sorry, you need to add ,0.0.0.0/0 to thr list. It is a shorthand that whitelists all ip-addresses.

[UltraBlackLinux]

that worked, awesome! Thank you very much :)

[mathisloge]

@szaimen I've runned into the same error. Will it get fixed by aio or do I have to add it manually?

Does it have any security implications, when whitelisting all ip-addresses ?

[steamrick]

Thanks, that worked for my after my external IP address changed (after more than a year of being static).

@mathisloge you'll need to add it manually in the 'Allow list for WOPI requests' section of the 'office' settings tab.
There shouldn't be any security implications since by default the only way to reach the nextcloud office service is through nextcloud - and by the time an attacker is in there, it's already too late.

[coreflake1]

Wouldn't a solution as proposed here (using a network alias) would be more gracious ?
https://help.nextcloud.com/t/probably-dns-help-with-nc-docker-collabora-wireguard-tunnel/176562/5

If I understand this correctly it would mean that all the communication between the collabora and nextcloud happens on the same host.
From a security perspective this sounds the most desirable ?

I'm a little bit reluctant to try it out, because I'm not sure how it will behave with AIO auto updates.